Commit graph

11200 commits

Author SHA1 Message Date
Cassidy James Blaede
993d4bb630
install_linux: correct typo in Homebrew copy
Just a little typo I noticed when looking at the instructions. updated → updates
2026-04-23 10:35:16 -06:00
William Martin
db234016a1
Merge pull request #13206 from cli/dependabot/go_modules/charm.land/bubbletea/v2-2.0.6
chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6
2026-04-23 16:12:55 +02:00
dependabot[bot]
aba7c591f3
chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6
Bumps [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) from 2.0.2 to 2.0.6.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases)
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v2.0.2...v2.0.6)

---
updated-dependencies:
- dependency-name: charm.land/bubbletea/v2
  dependency-version: 2.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-23 14:04:05 +00:00
William Martin
3a0d49525d
Merge pull request #13163 from cli/dependabot/go_modules/charm.land/lipgloss/v2-2.0.3
chore(deps): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.3
2026-04-23 16:02:34 +02:00
William Martin
7051e276fd
Merge pull request #13162 from cli/dependabot/go_modules/github.com/google/go-containerregistry-0.21.5
chore(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5
2026-04-23 16:02:00 +02:00
William Martin
abc0dc6c23
Merge pull request #13161 from cli/dependabot/go_modules/github.com/mattn/go-isatty-0.0.21
chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21
2026-04-23 16:01:31 +02:00
William Martin
a9d36fb9ef
Merge pull request #13272 from cli/wm/fix-log-terminal-injection
Fix log terminal injection
2026-04-23 15:40:29 +02:00
William Martin
c8e0139919
Update acceptance/testdata/workflow/run-view-log-escape-sequences.txtar
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-04-23 15:31:38 +02:00
William Martin
9a3dc9fce7 Fix log terminal injection 2026-04-23 13:56:33 +02:00
Babak K. Shandiz
3ad29588b8
Merge pull request #13259 from cli/fix-sample-rate-dimension-sync
Fix SetSampleRate not updating sample_rate dimension
2026-04-22 13:13:58 +01:00
William Martin
7095e2a4fc
Fix SetSampleRate not updating sample_rate dimension
The sample_rate common dimension was set once at service creation
time and never updated when SetSampleRate was called later. This
caused commands like 'gh skill publish' that override the sample
rate via PersistentPreRunE to report the wrong sample_rate in
telemetry events (e.g. 1 instead of 100).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-22 13:04:57 +01:00
William Martin
6d986480b8
Merge pull request #13258 from orbisai0security/fix-shell-injection-deployment-workflow
fix: using variable interpolation `${{ in deployment.yml...
2026-04-22 12:55:43 +02:00
orbisai0security
f52acd51e9 fix: yaml.github-actions.security.run-shell-injection.run-shell-injection security vulnerability
Automated security fix generated by Orbis Security AI
2026-04-22 16:05:54 +05:30
William Martin
6fffc2e66a
Merge pull request #13254 from cli/wm/enable-telemetry
Enable telemetry without env var
2026-04-22 12:16:33 +02:00
Babak K. Shandiz
b5757eab2a
Merge pull request #13244 from cli/kw/agent-skills
docs(skills): add gh and gh-skill agent skills
2026-04-21 19:26:07 +01:00
William Martin
90ef03ea38
Enable telemetry without env var 2026-04-21 18:40:02 +01:00
William Martin
3a6d4de90a
Merge pull request #13255 from cli/wm/log-no-events
Log when there is no telemetry
2026-04-21 19:30:51 +02:00
Sam Morrow
92e812b749
Merge pull request #13236 from cli/sammorrowdrums/skill-install-upstream-provenance 2026-04-21 19:29:31 +02:00
Babak K. Shandiz
0467ed499a
test(telemetry): assert ANSI escape chars for color codes
Signed-off-by: Babak K. Shandiz <babakks@github.com>
2026-04-21 18:05:28 +01:00
Babak K. Shandiz
ec4a3ed6bd
fix(telemetry): lower bias in sample bucket calc
Signed-off-by: Babak K. Shandiz <babakks@github.com>
2026-04-21 17:49:28 +01:00
William Martin
fe90f9a503
Add telemetry command (#13253) 2026-04-21 18:45:23 +02:00
Sam Morrow
50f0f8fc68
feat(skills): detect re-published skills and offer upstream install
When installing a skill whose SKILL.md contains github-repo metadata
pointing to a different repository, the CLI detects it as a re-published
skill and offers to redirect the install to the upstream source.

In interactive mode, the user is prompted to choose between the
re-publisher (default) and the upstream. In non-interactive mode,
the install proceeds from the re-publisher with a notice.

The --upstream flag skips the prompt and redirects to upstream directly,
enabling non-interactive upstream installs in CI/scripts.

If the user chooses upstream, the install restarts from that repo,
resolving the latest version and discovering skills fresh. A
skill_upstream_redirect telemetry event is emitted to track redirects.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-21 18:39:35 +02:00
William Martin
571bb1c923 Log when there is no telemetry 2026-04-21 18:15:04 +02:00
William Martin
6b811db467 Add telemetry command 2026-04-21 17:13:27 +02:00
William Martin
e52070e07e
Merge pull request #13205 from cli/wm/record-official-extension-telemetry
Record official extension telemetry
2026-04-21 11:57:11 +02:00
William Martin
c50fb793ea Record official extension telemetry 2026-04-21 11:48:32 +02:00
Sam Morrow
1b236f23c5
Merge pull request #13249 from cli/sammorrowdrums/fix-skill-install-preview-sha
fix(skills): match skills by install name in preview command
2026-04-21 11:30:11 +02:00
Sam Morrow
6fcc9c24df
fix(skills): prioritize DisplayName/Name over InstallName match
Use a two-pass search so exact DisplayName and Name matches are
preferred over InstallName. This avoids incorrectly selecting a
plugins-convention skill via InstallName when a standard namespaced
skill with a matching DisplayName exists later in the sorted slice.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-21 10:09:20 +02:00
Sam Morrow
a67f4f7303
Merge pull request #13235 from cli/sammorrowdrums/fix-skill-install-discovery
Make skill discovery less strict: support nested `skills/` directories
2026-04-21 10:01:53 +02:00
Sam Morrow
1160943af3
fix(skills): match skills by install name in preview command
The preview command's selectSkill function only matched skills by
DisplayName() and Name. For plugins-convention skills, the install
hint outputs InstallName() (namespace/name), which matched neither -
DisplayName() includes a [plugins] prefix and Name is just the base
name. This caused 'skill not found' errors when users ran the
suggested preview command after install.

Add InstallName() as an additional match criterion so that namespaced
skill identifiers produced by the install hint are accepted.

Closes #13248

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-21 09:56:27 +02:00
Kynan Ware
74d377313a
use the right json field names for skills
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-04-20 14:22:08 -06:00
Kynan Ware
01e345082c
fix totalCount guidance
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-04-20 14:21:26 -06:00
Kynan Ware
65974f568f docs(skills): note --template collisions and single-string search
Addresses review feedback on PR #13244:

- Flag that --template/-T collides with body-template flags on
  pr create / issue create, so agents should check --help.
- Recommend the single quoted-string form for gh search (matching
  --search), since multi-arg invocations join oddly and can produce
  invalid queries.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 14:18:46 -06:00
Kynan Ware
72884d9e41
backtick skill filename
Co-authored-by: Babak K. Shandiz <babakks@github.com>
2026-04-20 14:14:07 -06:00
Kynan Ware
01ca82955b docs(skills): drop hand-copied naming rules from gh-skill
Avoids drift between this skill and the actual validation logic in
publish. Agents should run `gh skill publish --dry-run` to learn the
current rules from the source of truth.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 14:12:27 -06:00
Kynan Ware
991e37dc25
use hyphen instead 2026-04-20 14:07:56 -06:00
Kynan Ware
33789149b9 docs(skills): add gh and gh-skill agent skills
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 13:38:59 -06:00
Sam Morrow
9a368f45e9
feat(skills): support nested skills/ directories in discovery
Relax skill discovery to recognize skills/ directories at any depth
in the repository tree, not just at the root. This enables repos like
hashicorp/agent-skills that organize skills under prefixes such as
terraform/code-generation/skills/*/SKILL.md.

Changes:
- matchSkillConventions: add checks for <prefix>/skills/<name>/SKILL.md
  and <prefix>/skills/<ns>/<name>/SKILL.md at any depth
- isSkillPath: also match paths containing /skills/ for direct
  path-based install
- DiscoverSkillByPath: fix namespace detection to find the skills
  segment anywhere in the path
- Update error messages and help text to mention nested conventions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 21:07:15 +02:00
Sam Morrow
49d4747a81
Merge pull request #13237 from cli/sammorrowdrums/fix-skill-publish-fix-flag 2026-04-20 19:23:09 +02:00
Sam Morrow
f88a2a671c
fix(skills): make --fix and --dry-run mutually exclusive, suppress publish prompt
- --fix and --dry-run now error when combined
- "Ready to publish!" is suppressed when --fix is set since user must
  commit first

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 12:36:57 +02:00
Sam Morrow
c703294fbe
fix(skills): use canonical 'gh skill' not 'gh skills' alias
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 12:34:59 +02:00
Sam Morrow
2e64043d55
fix(skills): stop publish --fix from publishing
When --fix is used, return early after applying fixes instead of
continuing to the publish flow. The fixed files need to be committed
before publishing, so proceeding would fail anyway since the repo
would not be in sync.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 12:22:55 +02:00
William Martin
43f9944920
Merge pull request #13210 from cli/wm/record-ci
Record CI context in telemetry
2026-04-20 12:14:20 +02:00
William Martin
78f1ad537c Include CI context in telemetry 2026-04-20 12:02:56 +02:00
Sam Morrow
61a7865380
Merge pull request #13213 from cli/sammorrowdrums/sm-allow-hidden-dirs-flag
Add --allow-hidden-dirs flag to gh skill install
2026-04-20 11:33:12 +02:00
Sam Morrow
eaa018545a
refactor: decouple hidden-dir filtering from discovery layer
Move --allow-hidden-dirs filtering logic from the discovery package to
the install command, addressing review feedback. Discovery functions now
always return all skills (including hidden-dir), and callers decide how
to handle them.

Changes:
- DiscoverSkillsWithOptions/DiscoverLocalSkillsWithOptions always return
  hidden-dir skills; callers filter using IsHiddenDirConvention()
- DiscoverSkills/DiscoverLocalSkills (convenience wrappers) auto-filter
  hidden-dir skills for backward compatibility with preview/update/publish
- Remove --allow-hidden-dirs reference from discovery error messages
- Add filterHiddenDirSkills in install.go with caller-side flag logic
- Inline warning using heredoc.Docf, remove printHiddenDirWarning
- Add inline comments in matchHiddenDirConventions (babakks nitpicks)
- Add non-hidden-namespaced dir and no-skills-at-all test cases
- Add --allow-hidden-dirs tests in TestNewCmdInstall, TestInstallRun,
  and TestRunLocalInstall

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-20 11:14:39 +02:00
Tommaso Moro
082f15a8fd
Add support for installation in multiple agent hosts in gh skills install (#13209)
* add support for installation in multiple agent host

* print correct dir in warning

* remove dir as it depends on user vs project installation scope

* Move comment closer to assertion in registry test

Move the explanatory comment from above the map initialization to
directly above the assertions it describes, per review feedback.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* List supported agent names and IDs in help text

Replace the self-referencing "run --help" sentence with an inline list
of all supported --agent values showing Name (id) pairs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use heredoc.Docf for Kiro CLI post-install hint

Replace individual fmt.Fprintln calls with a single heredoc.Docf block
for the Kiro CLI post-install guidance, per review feedback. Also
shorten the --agent flag usage line by overriding the auto-generated
enum list with a reference to the supported values in the help text.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-18 15:22:09 -06:00
William Martin
998b6212b3
Add skills specific telemetry
* Add skills specific telemetry

* Remove VisibilityFuture, inline goroutine at call sites

The VisibilityFuture/FetchRepoVisibilityAsync/Wait wrapper was an
unidiomatic async abstraction built for a single pattern used in
exactly two call sites. In Go the channel is already the future;
wrapping it in a struct with a Wait(timeout) method adds no value.

Delete the abstraction and inline a local visResult struct,
buffered channel, goroutine, and select at each call site. Behavior
is preserved exactly: err -> "unknown", timeout -> "unknown",
success+public -> include skill_names.

FetchRepoVisibility (synchronous) is kept as-is.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix nonsense copilot tests

* Update telemetry tests for public-only dims and search event removal

Production telemetry emission changed:
- preview: skill_owner/skill_repo/skill_name (renamed from skill_names)
  are now emitted only when repo_visibility=public.
- install: skill_owner/skill_repo/skill_names are now emitted only
  when repo_visibility=public.
- search: the initial skill_search event was removed entirely; the
  skill_search_install event no longer carries query/owner dims.

Update tests to match: rename skill_names -> skill_name in preview,
make owner/repo assertions conditional on public visibility in both
preview and install, and reduce the search test to a single event
with explicit Empty assertions for the removed query/owner dims so a
privacy regression cannot pass silently.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Test CategorizeHost and switch telemetry to skill_host_type

Add TestCategorizeHost covering all four classification branches
(github.com, ghes, tenancy, uncategorized) with cases verified
against the real ghauth implementation rather than guessed.

Update install and preview unit tests to assert the new
skill_host_type dimension name, and fix a typo in the preview
acceptance txtar (skill_hos_type -> skill_host_type).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Shrink visibility wait and test unknown visibility

The 2s visibilityWaitTimeout was wildly overprovisioned: by the time
telemetry emission reaches the select, the command has already done
several serial GitHub REST calls (and for install, a git sparse-checkout
plus possibly interactive prompts), so the one-call visibility fetch
has almost always completed. Drop the timeout to 200ms — a short safety
net for a stalled REST call, not a wait budget for a healthy one.

Also adds a table-driven case to TestFetchRepoVisibility covering an
unknown/future visibility value from the API, addressing @babakks'
review nitpick.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-04-17 19:58:59 +02:00
William Martin
451d399eac
Merge pull request #13192 from cli/wm/no-alias-telemetry
Do not send telemetry for aliases
2026-04-17 14:40:22 +02:00
dependabot[bot]
fd28f058aa
chore(deps): bump github.com/google/go-containerregistry
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.4 to 0.21.5.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.21.4...v0.21.5)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-17 12:30:09 +00:00